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What is the problem under consideration? Why is regulatory action or 
intervention necessary? 


The Information Commissioner was required to prepare the Data protection 
and journalism code under section 124 (s124) of the Data Protection Act 2018 
(DPA 2018) to provide practical guidance about processing personal data for 
the purposes of journalism in accordance with the requirements of the data 
protection legislation; and other guidance, as considered appropriate to 
promote good practice when processing personal data for the purposes of 
journalism. 


What regulatory policy options have been considered, including any 
alternatives to regulation? Please justify preferred option 


As the code and its remit was mandated by Parliament in s124 DPA 2018, it 
was not appropriate for the Commissioner to consider any alternative course 
of action. This is described in more detail in the body of this assessment. 


Summary of Impacts 


The majority of impacts assessed are found to be not attributable to the code. 
This is primarily because of the terms of the statutory requirement to produce 
the code and the need for controllers to comply with the existing legislation. 
There are likely to be some additional beneficial impacts driven by increased 
regulatory certainty, confidence, and a reduction in the risk and severity of 
harms in the context of data protection and journalism. Although it’s not 
possible to accurately estimate the scale of impacts, any costs associated with 
the code are likely to be outweighed by these beneficial impacts. 


Will the intervention be reviewed? 


The code will be kept under review in line with good regulatory practice, with 
s124 (2) of the DPA 2018 allowing the Commissioner to make amendments or 
lay a replacement code. 
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Data protection and journalism code impact assessment 


Executive summary 


This impact assessment sets out the benefits and costs associated with the Data 
protection and journalism code of practice (the code). It draws on evidence 
including desk-based research, responses to an initial call for evidence, and 
responses to our consultation. 


Overall assessment 


The code has a strong rationale and aligns well with relevant policy. Our overall 
assessment of the code is illustrated in Table 1. The costs assessed are found to 
be not attributable to the code. This is primarily because of the terms of the 
statutory requirement to produce the code and the need for controllers to 
comply with the legislation. There are likely to be some additional beneficial 
impacts driven by increased regulatory certainty, confidence, and a reduction in 
the risk and severity of harms in the context of data protection and journalism. 
Although it’s not possible to accurately estimate the scale of impacts, any costs 
associated with the code are likely to be outweighed by these beneficial impacts. 


Table 1: Summary of impacts 


Positive, neutral or Attributable to 


Impact i 
P negative the code 
N i | 
Familiarisation costs Negative A te 
the code 
Reduced data protection harms Positive Attributable 
In in n 
oradanda ane mane ‘ Positive Attributable 
organisational confidence 
Overall assessment Positive Attributable 


Source: ICO Economic Analysis. 


Context 


The Data Protection Act 2018 (DPA 2018) requires the Information 
Commissioner's Office (ICO) to prepare a statutory code of practice. The code’s 
purpose is to help those processing personal data for journalism understand 
what data protection law says and how to comply with it. In preparing the code, 
the ICO must specifically consider the special public interest in protecting 
freedom of expression and information. 


We consider that the code is well-aligned with current published policy that the 
Government and industry bodies are pursuing and work is ongoing to strengthen 
alignment with policy under development. The policies reviewed include: 


e The Leveson inquiry; 
e the National data strategy; 
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e the draft Online Safety bill; 
e the draft Data Protection and Digital Information bill; and 
e relevant industry codes. 


As well as delivering an important service to society, journalism also plays an 
important role in the economy with around 107,000 professional journalists and 
editors in the UK. The media eco-system has been transformed by increased 
digitalisation of the economy which has presented challenges to media business 
models. The COVID-19 pandemic led to an increase in reach for major news 
outlets but this has subsided more recently with a fall in consumption across all 
formats in 2022. 


Although a lot of journalism, especially on a day-to-day basis, does not raise 
data protection concerns, there are some occasions when it could. When this 
does occur, the power and influence of the press means that processing personal 
data for the purposes of journalism has the potential to cause substantial harm 
to people. 


In addition, an overarching societal harm that may occur is harm to the 
important public interest that journalism serves. Journalism has a special role in 
supporting the free flow of communication and holding the powerful to account. 
This may be undermined by a lack of public trust arising from, for example, 
inaccurate news. 


This impact assessment identifies instances of harm caused by personal data 
being processed for journalism. This includes physical harm, material harm (such 
as financial harm) and non-material harm (such as distress).+ Specific harms 
covered in this impact assessment are: 


e bodily or emotional harm; 

e financial loss and damage to reputation; 

e stereotyping, racism and discrimination; 

e unlawful privacy intrusion; and 

e confidentiality and prejudice to the course of justice. 


The rationale for the code is provided by the statutory duty to produce it under 
s124 DPA 2018. Looking beyond this, the potential to reduce the risk of data 
protection harms and alignment with industry and published government policy 
objectives provide further evidence for its need. 


1 For more information on data protection harms, see Data protection harms | ICO. 
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1. 


Introduction 


This document sets out the findings from our assessment of the impact of the 
data protection and journalism code. The purpose of the impact assessment is 


to: 


provide an objective view of the costs and benefits of the code, 
guide and inform the design of the code and potential mitigation 
measures, and 

set a baseline for future review activity. 


The remaining sections of the report are: 


2: Our approach to the impact assessment: explains the approach 
taken to assessing the impacts of the code. 

3: Context and rationale: sets out the economic, social and political 
context for the code as well as the rationale for producing it. 

4: Detail of proposed intervention: provides an overview of the 
proposed data protection and journalism code and the affected groups. 
5: Costs and benefits of the code: presents the findings of the cost 
benefit analysis for the code. 

6: Monitoring and review: outlines future monitoring considerations. 
Finally, Annex A gives more detail on how familiarisation costs are 
estimated to support the assessment of costs and benefits. 
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2. Our approach to the impact assessment 


We have assessed the impacts of the code using cost-benefit analysis, which 
aims to identify the full range of impacts by assessing both the costs and 
benefits of the code. Our approach follows HM Treasury’s Green Book, 
Regulatory Policy Committee,? and Business Impact Target* guidance on best 
practice for impact assessments. However, it is not practical nor necessary to 
consider in detail all the code’s implications, in line with proportionality 
principles. 


As the code is a statutory requirement, the Commissioner did not have an option 
to consider any alternative actions or regulatory intervention. For this reason, 
we have only considered the impact of the code in our assessment. This is 
consistent with our proportionate approach to impact assessments for statutory 
codes, see the Data sharing code of practice? and the Age-appropriate design 
code of practice. ê 


2.1. Theory of change 


Our analysis is based on a theory of change, which is a systematic approach 
used in intervention design and evaluation that provides a visual or narrative 
representation of how and why an intervention is expected to work, outlining the 
causal pathways and linkages between inputs, activities, outputs, outcomes and 
impacts. 


We consider the activities carried out by the ICO, UK organisations and people in 
the UK and then consider how immediate, intermediate and long-term outcomes 
contribute to impact. This framework also guides the structure of this report, and 
the remaining chapters are colour coded according to the relevant section of the 
theory of change that they refer to. For example, the discussion around costs 
and benefits of the guidance is purple to match this section in the theory of 
change, as illustrated in Figure 1. 


? HM Treasury (2022) The Green Book: appraisal and evaluation in central government. Available at: 

https ://www.gov.uk/government/publications/the-green-book-appraisal-and-evaluation-in-central-governent 
(Accessed 19 April 2023). 

3 Regulatory Policy Committee (2019) RPC guidance for Departments and Regulators. Available at: 

https ://www.gov.uk/government/collections/rpc-guidance-for-departments-and-regulators (Accessed 19 April 
2023). 

4 BEIS (2019) Business impact target statutory guidance. Available at: 
https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/776507/B 
usines Impact Target Statutory Guidance January 2019.pdf (Accessed 19 April 2023). 

5 ICO (2021) Data sharing code of practice - Impact assessment. Available at: 
https://ico.org.uk/media/2619796/ds-code-impact-assessment-202105.pdf (Accessed 19 April 2023). 

6 ICO (2020) Age appropriate design: a code of practice for online services - Impact assessment. Available at: 
https://ico.org.uk/media/2617988/aadc-impact-assessment-vi_ 3.pdf (Accessed 19 April 2023). 
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Figure 1: Theory of change 
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2.2. Approach 


We collected evidence for the impact assessment using the following methods 
and sources: 


e desk-based research, and 
e responses to the public consultations on the code. 


Consideration of options 


As the code and its remit was mandated by Parliament in s124 DPA 2018,” it 
was not appropriate for the Commissioner to consider any alternative courses of 
action. 


Counterfactual 


To help us measure the impact of the code, we have taken as our starting point 
what the situation is now, known as the counterfactual. The counterfactual is the 
baseline against which we estimate the additional impacts of introducing the 
code. If the code was not introduced, then the underlying data protection 
legislation and existing guidance would continue to apply and form the 
counterfactual for the purposes of this assessment. 


In line with impact assessment guidance,® we assume compliance both with 
existing legislation and guidance within the code, in the absence of specific 
evidence to suggest otherwise. This simplifies the assessment, but it is not 
intended to suggest that there is total compliance. If we did identify any specific 
lack of compliance, the code would help controllers to improve. 


As a statutory code of practice, the code does not impose any additional legal 
obligations. This limits the code’s additional impacts over and above that of the 
counterfactual. 


Monetising impacts 


Quantified analysis of the impacts is particularly challenging for the code 
because of its wide-ranging scope and the difficulty in quantifying the affected 
groups. 


Calculating the additional cost to controllers is also complex because the nature 
of these costs varies considerably depending on different factors, for example: 


e how sophisticated and mature the controller’s existing data protection 
systems and processes are, 
e the nature of the activities, 


7 Data Protection Act 2018. Available at: https://www. legislation.gov.uk/ukpga/2018/12/section/124/enacted 
(Accessed 19 April 2023). 

8 BEIS (2017) Business impact target. Available at: 
https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/609201/b 
usiness-impact-target-quidance-appraisal.pdf (Accessed 19 April 2023). 
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e the processing associated with those activities, and 
e the level of risk to people. 


It is similarly challenging to quantify many of the code’s benefits because of 
their intangible nature, such as: 


e reductions in harm, 
e increased controller understanding, or 
e increased trust amongst the public. 


Our analysis therefore focuses primarily on non-monetised impacts. However, 
where possible, we have provided high level quantitative analysis to indicate 
scale. 


Uncertainty, risk and optimism bias 


As set out in the Treasury’s Green Book, it is necessary to consider the 
significant levels of uncertainty surrounding the impacts of the code. Although 
optimism bias is typically only considered in capital projects,? we understand 
that there can be a tendency to overestimate engagement with guidance. To 
account for and demonstrate the implications of any potential bias, we have 
provided sensitivity analysis for the impacts we have been able to quantify. !° 
This tests the sensitivity of impact estimates to changes in assumptions and is 
provided in Annex A. 


° Department for Finance of Northern Ireland. Step six: assess risk and adjust for optimism bias - section 
2.6.27. Available at: https://www.finance-ni.gov.uk/articles/step-six-assess-risks-and-adjust-optimism-bias 
(Accessed 19 April 2023). 


10 See para 5.59 of HM Treasury’s Green Book for more information on sensitivity analysis. HM Treasury (2022) 


The Green Book: appraisal and evaluation in central government. Available at: 
https://www.gov.uk/government/publications/the-green-book-appraisal-and-evaluation-in-central-governent 


(Accessed 19 April 2023). 
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3. Context and rationale 


This section sets out the problem the guidance is attempting to solve, the 
economic, social and political context, the policy context, and the data protection 
harms related to processing personal data for journalism. 


3.1. Problem Definition 


We have a statutory duty to produce the code under s124 of the DPA 2018. 
However, beyond this, the code is likely to reduce the risk (in terms of likelihood 
and severity) of data protection harms, such as those identified below. It is also 
well-aligned with published government policy and industry codes. Taken 
together, there are strong reasons for this policy intervention. 


3.2. Social and economic context 


3.2.1. Freedom of Expression 


The code’s purpose is to help those processing personal data for journalism 
understand what data protection law says and how to comply with it. The code 
takes into account the importance of the right to freedom of expression and 
information. 


As set out in the code, freedom of expression and information is a fundamental 
right that makes a vital contribution to our democracy. The right to freedom of 
expression and information concerns the right to exchange information, debate 
ideas and express opinion.!! A free press is clearly vital to this. Generally, a free 
press informs, entertains, and increases citizen debate and participation in 
society. It also acts as a public watchdog to hold the powerful to account and 
uncover wrongdoing. 1? 


The right to freedom of expression is balanced with other areas that are also 
considered fundamental in a democracy, including the right to privacy. 1? A 
degree of privacy, and limits on intrusion, is needed to protect citizens’ private 
and family life, their home and correspondence. t4 


11 Equality and Human Rights Commission (2021) Article 10: Freedom of expression. Available at: 

https ://www.equalityhumanrights.com/en/human-rights-act/article-10-freedom-expression (Accessed 02 June 
2023). 

12 Human Rights Careers (n.d.) Why is freedom of the press important in a democracy? Available at: 
https://www.humanrightscareers.com/issues/why-is-freedom-of-the-press-important-in-a-democracy/ 
(Accessed 02 June 2023). 

13 Equality and Human Rights Commission (2021) Article 10: Freedom of expression. Available at: 
https://www.equalityhumanrights.com/en/human-rights-act/article-10-freedom-expression (Accessed 02 June 
2023). 

14 Equality and Human Rights Commission (2021) Article 8: Respect for our private and family life. Available 
at: https://www.equalityhumanrights.com/en/human-rights-act/article-8-respect-your-private-and-family-life 
(Accessed 02 June 2023). 
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There is also a strong public interest in data protection. Data protection enables 
people to understand what happens to their personal data, and exercise 
proportionate control over this process. Sometimes the data may be private, in 
which case it also involves the right to privacy. 


“Each and every day we are reminded of how vital the information [the press, 
journalists and media workers] provides is for democracy, the promotion and 
protection of human rights, fighting corruption, sustainable development and 
preserving international peace and security.” 


United Nations General Assembly, UNESCO General Conference and the Human 
Rights Councilt> 


The importance of both freedom of expression and privacy is recognised by the 
UK courts!® and the European Court of Human Rights. 17 More broadly, privacy 
and data protection are two rights enshrined in the EU Charter of Fundamental 
Rights, which is reflected in the UK GDPR*® and the DPA 2018.1? 


3.2.2. Economic Context 


As well as delivering an important service to society, journalism also plays an 
important role in the economy. The ONS estimates that there are around 
107,000 professional journalists and editors in the UK, equivalent to 0.3% of all 
employment nationally. 2° 


Employment in the journalism industry is not evenly distributed across UK 
regions. Approximately half (48%) of these jobs are based in London, with 
another 19% in the East of England and South East of England. Figure 2 shows 
that jobs in the sector make up a relatively significant percentage of all jobs in 
London (1.1%), the East of England (0.3%) and the South West of England 
(0.3%). This suggests these regions are more sensitive to changes in the sector 
and impacts are unlikely to be evenly distributed across the UK. 


15 United Nations (2022) Joint statement on the safety of journalists on the occasion of the world press 
freedom day 2022, Available at: https://www.ohchr.org/en/statements/2022/05/joint-statement-safety- 
journalists-occasion-world-press-freedom-day-2022 (Accessed 24 April 2023). 

16 Human Rights Act 1998. Available at: https://www.legislation.gov.uk/ukpga/1998/42/contents (Accessed 02 
June 2023). 

17 European Convention of Human Rights. Available at: https://www.coe.int/en/web/conventions/full- 

list? module=treaty-detail&treatynum=005 (Accessed 02 June 2023). 

18 Regulation (EU) 2016/679 of the European Parliament and of the Council. Available at: 
https://www.legislation.gov.uk/eur/2016/679/contents (Accessed 24 April 2023). 

19 Data Protection Act 2018. Available at: https://www.legislation.gov.uk/ukpga/2018/12/section/124/enacted 
(Accessed 19 April 2023). 

20 ONS (2023) Annual Population Survey - regional - occupation (SOC2020). Available at: 
https://www.nomisweb.co.uk/datasets/aps218 (Accessed 30 May 2023). 
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Figure 2: Journalists as a proportion of employment by region, December 2022 
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Source: ONS (2023) Annual Population Survey - regional - employment by occupation 
(SOC2020); Journalists defined as SOC 2491 (Newspaper and periodical editors) and 
SOC 2492 (Newspaper and periodical journalists and reporters). 


It is difficult to accurately estimate the number of organisations whose main 
purpose is journalism. The ICO’s Data protection register has approximately 
7,690 organisations registered under ‘Journalist’ and ‘TV and radio station’. This 
provides some indication but could underestimate the true scale as some 
organisations are exempt from paying the data protection fee. 2+ 


Business count data from the ONS,?? gives an estimate of around 5,300 
enterprises operating across the sector. As Figure 3 shows, the majority (42%) 
of enterprises belong to the ‘Publishing of consumer, business and professional 
journals and periodicals’ industrial category. The figure estimated using ONS 
data is lower than the ICO’s data protection register. There could be a number of 
reasons for this, such as certain organisations like citizen journalists not being 
picked up in national statistics. 


21 See: https://ico.org.uk/for-organisations/data-protection-fee/data-protection-fee/exemptions/ for more 
information. 


22 ONS (2022) UK business; activity, size and location. Available at: 
https://www.ons.gov.uk/businessindustryandtrade/business/activitysizeandlocation/bulletins/ukbusinessactivit 
ysizeandlocation/2022 (Accessed 02 June 2023). 
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Figure 3: Enterprises by sub-sector, December 2022 
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Source: ONS (2022) UK business; activity, size and location. 


The media eco-system in the UK and globally has been transformed by the 
increased digitalisation of the economy and through a series of highly impactful 
events in recent years. During the COVID-19 pandemic, the main television 
journalism outlets (ie BBC, ITV and Sky News) all increased their weekly reach. 
This was however temporary, and overall news consumption fell across all 
formats in 2022. In particular, the reach of national and local newspapers has 
fallen from 36% in 2019 to 17% in 2022. While digital subscriptions have 
continued to rise, only a small minority of users (9%) regularly pay for online 
news. ?3 


3.2.3. Data protection harms related to processing personal data for the 
purposes of journalism 


Although a lot of journalism, especially on a day-to-day basis, does not raise 
data protection concerns, there are occasions when it does. When this does 
occur, the power and influence of the sector means that processing personal 
data for the purposes of journalism has the potential to cause substantial harm 
to people. This is due in part to its access to large audiences. 


Part 1 of the Leveson inquiry in 2012 found evidence of unethical cultural 
practices in parts of the press that caused harm (see section 3.3). The harm to 
people's rights and freedoms can vary in degree and type. In line with damages, 
as described in Article 82 of the UK GDPR, harms can include: 


23 Reuters Institute for the Study of Journalism (2022) 2022 Digital News Report. Available at: 
https://reutersinstitute.politics.ox.ac.uk/digital-news-report/2022/united-kingdom (Accessed 20 April 2023). 
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e physical harm: physical injury or other harms to physical health, 

e material harm: harms that are more easily monetised such as financial 
harm, or 

e non-material harm: less tangible harms such as distress. 


This means that harm can arise from actual damage and more intangible harm, 
including any significant economic or social disadvantage. Of course, harms may 
also fall into more than one of these categories. ** 


There may be a harmful impact on wider society. For example, unfair processing 
or use of inaccurate personal data for the purposes of journalism may lead to a 
loss of public trust. Ultimately, this undermines the important public interest role 
that journalism serves in our democracy. 


The recent Digital News Report by the Reuters Institute for the Study of 
Journalism states that in the UK only 34% of people trust news most of the time 
in 2022 (down from 36% in 2021, and down 17 percentage points on 2015).7° A 
global survey on trust in professions ranked journalists 26t" out of 30 
professions, with only 29% of people generally trusting journalists to tell the 
truth. 2° 


While the specific causes of this reported lack of trust are unclear, and there is 
disparity between trust in different news brands, the 2022 Digital News Report?’ 
states that: 


“,..we find that indifference to news and its value, along with widespread 
perception of political and other biases by the media, are two of the main 
reasons for low trust”. 


Of course, there are numerous positive examples of journalism serving the 
public interest by holding public figures to account and exposing wrong-doing. 
Specific examples include: 


e an investigation by 17 media organisations revealing widespread and 
continuing abuse of hacking spyware, Pegasus, to target politicians, 
activists and others; 28 


24 ICO - Data protection harms. Available at: https://ico.org.uk/about-the-ico/research-and-reports/data- 
protection-harms/ (Accessed 24 April 2023). 

2° Reuters Institute for the Study of Journalism (2022) 2022 Digital News Report. Available at: 
https://reutersinstitute.politics.ox.ac.uk/digital-news-report/2022/united-kingdom (Accessed 20 April 2023). 
26 Ipsos (2022) Ipsos veracity index 2022. Available at: https://www.ipsos.com/en-uk/ipsos-veracity-index- 
2022 (Accessed 23 May 2023). 

27 Reuters Institute for the Study of Journalism (2022) 2022 Digital News Report. Available at: 
https://reutersinstitute.politics.ox.ac.uk/digital-news-report/2022/united-kingdom (Accessed 20 April 2023). 
28 News Media UK (2022) The Pegasus project. Available at: https://newsmediauk.org/blog/case-studies/the- 
pegasus-project/ (Accessed: 25 May 2023). 
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e publication of information on secret offshore bank accounts of 35 world 
leaders, billionaires, celebrities and leaders - shining a spotlight on the 
offshore industry and democratic accountability; 2° and 

e an exclusive on deaths at the Rochdale Freehold Estate, leading to a 
review of living conditions at the homes as well as fostering a wider 
debate on housing conditions. *° 


To aid understanding of some of the harms the code seeks to address, we have 
provided some examples below. This list is not exhaustive or hierarchical. 


Unlawful privacy intrusion 


Unlawful privacy intrusion occurs when private personal data is processed in a 
way that is not in line with the key data protection principles. For example, when 
private personal data is processed in a way that was outside someone’s 
reasonable expectations and which cannot be justified in the circumstances. 


Harm to someone’s privacy may vary significantly in severity depending on 
different factors, such as the nature of the private information and who it is 
about. For example, there is likely to be a greater risk of harm generally when 
using special category data or criminal offence data, which is given specific extra 
protection under data protection law. Children are also given extra protection. 


Some intrusive activities are criminal offences under the DPA 2018.3! For 
example, legal actions concerning phone-hacking of public figures by parts of the 
press in the past are still ongoing. 


Unlawful privacy intrusion violates the right to privacy that is a protected human 
right. It may cause a person to feel a loss of control over their personal data and 
interfere with their right to autonomy, integrity, dignity and respect. There are 
likely to be other harmful consequences as well, such as distress or reputational 
damage. 


Example: Naomi Campbell 


In Naomi Campbell v MGN Ltd.,?? photographs were taken of Miss Campbell in a 
public street leaving a Narcotics Anonymous meeting. 


The judge said that the mere fact of covert photography is not sufficient to make 
information private, but he found that the newspaper had misused private 
information in this case. He said that, in context, the picture added to the 
information conveyed by the story and the potential harm, by making Miss 


2° News Media UK (2022) Pandora papers. Available at: https://newsmediauk.org/blog/case-studies/pandora- 
papers/ (Accessed: 25 May 2023). 

30 News Media UK (2022) Rochdale Freehold Estate. Available at: https://newsmediauk.org/blog/case- 
studies/rochdale-freehold-estate/ (Accessed: 25 May 2023). 

31 See sections 170 to 173 of the DPA 2018 for some specific examples of offences under the act. 

32 Naomi Campbell v MGN Ltd. [2004] UKHL 22. Available at: 

https://www. bailii.org/uk/cases/UKHL/2004/22.html (Accessed 24 April 2023). 


11 


Data protection and journalism code impact assessment Context and rationale 


Campbell think she was being followed or betrayed, and deterring her from 
going back to the same place for treatment. 


Bodily or emotional harm 


In some cases, processing personal data for the purposes of journalism poses 
risks to people’s physical or emotional health, or both. For public figures or 
people with a role in public life, the harm may accumulate over time because of 
persistent or frequent invasions of privacy. This may put people’s mental health 
under significant strain. 


Example: Can't pay? We'll take it away! 


Channel 5 filmed and broadcast two claimants being evicted from their home in 
a programme called ‘Can't Pay? We'll take it away!’. 


The programme disclosed private information, including personal data, to 
millions of viewers, without sufficient justification. A judge found that the 
footage showed the claimants at their lowest ebb, being evicted without prior 
notice, in a state of shock and very distressed. The court awarded damages for 
the privacy intrusion. 3 


Financial loss and damage to reputation 


This includes loss of employment or income. This material harm is commonly 
linked to reputational harm. Financial loss may also occur because of steps taken 
to mitigate harm, such as pursuing expensive legal action. 


Example: Sir Cliff Richard 


Sir Cliff Richard was awarded damages following the BBC’s decision to name him 
as a Suspect in an ongoing police investigation and to broadcast a search of his 
home. Sir Richard was not charged at the time or subsequently for any offence 
relating to this investigation. 


Sir Richard’s evidence included reference to a planned album being put on hold, 
cancelled public appearances, shelved book deals, retailers refusing to stock 
merchandise, as well as significant legal costs. His evidence also made it clear 
that these events seriously affected him physically and mentally. 34 


33 Ali and Aslam v Channel 5 Broadcast Ltd [2018] EWHC 298 (Ch). 
34 Sir Cliff Richard OBE v the BBC [2018] EWHC 1837 (Ch). Available at: https://www.judiciary.uk/wp- 
content/uploads/2018/07/cliff-richard-v-bbc-judgment.pdf (Accessed 30 May 2023). 
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Example: Bloomberg LP 


In this case, the Supreme Court considered the publication of information 
identifying a suspect pre-charge in a state investigation concerning a criminal 
allegation. The court said: 


“,..publication of such information ordinarily causes damage to the person’s 
reputation together with harm to multiple aspects of the person’s physical and 
social identify such as the right to personal development, and the right to 
establish and develop relationships with other human beings and the outside 
world...The harm and damage can on occasions be irremediable and profound”.*° 


Stereotyping, racism, and discrimination 


The inclusion of specific types of personal data in stories may contribute to 
stereotyping, racism and discrimination. 


A key principle of the UK GDPR is to minimise processing of personal data. This 
includes not processing irrelevant or excessive personal data. Personal data 
must also be accurate. Processing of personal data must be fair and lawful. 
Special category data includes personal data revealing or concerning information 
about racial or ethnic origin, or religious or philosophical beliefs. This type of 
data needs more protection because it is often particularly sensitive. 


Confidentiality and prejudice to the course of justice 


There is a strong public interest in ensuring that the process of justice is fair, 
and that legitimate duties of confidence are respected. For example, a duty of 
confidence may arise in the context of a state investigation regarding material 
relating to the investigation. If there is a breach of confidence, that in turn may 
prejudice the course of justice by interfering with an ongoing investigation. A 
breach of confidence in this context may also undermine confidence in the 
justice process which may deter people from reporting crimes. 


35 Bloomberg LP v ZXC [2022] UKSC 5, [71]. Available at: https://www.bailii.org/uk/cases/UKSC/2022/5.html 
(Accessed 30 May 2023). 
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Example: Bloomberg LP 


This case concerned Bloomberg’s publication of an article based on information 
from a confidential letter of request sent by a UK law enforcement body to a 
foreign state. 


The court acknowledged the strong public interest in observing duties of 
confidence generally and, more specifically, when it could prejudice an ongoing 
state investigation. °° 


Example: Sand Van Roy 


Associated Newspapers paid substantial damages to actor Sand Van Roy for 
revealing her identity as a complainant in a rape case against the French film 
director Luc Besson, following unlawful coverage in the French press. Sand Van 
Roy said that she hoped victims of crime would not be deterred by fear of their 
identity being publicised. 37 


3.3. Policy Context 


An important part of the context for the code and its objectives is its alignment 
with specific areas of policy that the government is pursuing at the time of 
preparing this impact assessment. 


The Leveson inquiry 


The Leveson inquiry*® was a judicial public inquiry into the culture and ethics of 
the UK press following evidence of phone hacking by News International and 
other media organisations. It ran from 2011-2012 and was chaired by Lord 
Justice Leveson. 


The inquiry considered the harm caused by the press to ordinary members of 
the public, people with a public profile and victims of crime, amongst others. The 
inquiry found evidence of unethical cultural practices in parts of the UK press. In 
particular, it found inaccuracy in press reporting and a lack of respect for 
individual privacy in circumstances where there was no, or insufficient, public 
interest justification. 


36 Ali and Aslam v Channel 5 Broadcast Ltd [2018] EWHC 298 (Ch). Available at: https://www.judiciary.uk/wp- 
content/uploads/2018/02/ali-v-channel5-judgment.pdf (Accessed 30 May 2023). 

37 The Guardian (2021) Associated Newspapers pays damages for revealing Sand Van Roy as Luc Besson 
accuser. Available at: https://www.thequardian.com/media/2021/may/21/associated-newspapers-pays- 
damages-for-revealing-sand-van-roy-as-luc-besson-accuser (Accessed 24 April 2023). 

38 DCMS (2012) Leveson Inquiry - Report into the culture, practices and ethics of the press. Available at: 

https ://www.gov.uk/government/publications/leveson-inquiry-report-into-the-culture-practices-and-ethics-of- 
the-press (Accessed 24 April 2023). 
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In January 2013 we published our response to the inquiry22 and in September 
2014 we published a guide on data protection and journalism for the media.*° 
The guidance was produced in response to a formal recommendation to the 
inquiry. 


Part II of the inquiry did not proceed as government judged that the terms of 
the second part had largely been met through changes made in response to Part 
1,4! both by journalists and through measures such as the Crime and Courts 
Act** and the creation of the Press Recognition Panel. 43 


However, requirements to support future compliance and review were 
introduced, including requirements for the ICO to: produce a data protection 
journalism code of practice under section 124 of the DPA 2018; and review the 
processing of personal data for the purposes of journalism under section 178 of 
DPA 2018. 


National data strategy 


The National data strategy** is the Government's pro-growth strategy for data. 
It focuses on the UK building a world-leading data economy, whilst making sure 
that the public trust how data is used. 


The code particularly complements pillar 4 of the strategy, ‘Responsible data’. 
This involves making sure that data is used responsibly, in a way that is lawful, 
secure, fair, ethical, sustainable, and accountable. These are key considerations 
in data protection law, which are discussed in the context of journalism in the 
code. 


One of the code’s key objectives is to build and sustain public trust in the 
processing of personal data for the purposes of journalism, which makes an 
extremely valuable contribution to democracy and society. 


The Cairncross review 


In February 2019, the Government published an independent report, the 
Cairncross review,® about securing a sustainable future for journalism. This 


39 ICO (2013) The Information Commissioner’s Response to the Leveson Report on the Culture, Practices and 
Ethics of the Press. Available at: https://ico.org.uk/media/about-the-ico/documents/1042562/ico-response-to- 
leveson-report-012013.pdf (Accessed 24 April 2023). 

4° ICO (2014) Data protection and journalism: a guide for the media. Available at: 
https://ico.org.uk/media/for-organisations/documents/1552/data-protection-and-journalism-media- 
guidance.pdf (Accessed 24 April 2023). 

41 DCMS (2018) Leveson consultation response. Available at: 

https ://www.gov.uk/government/speeches/leveson-consultation-response (Accessed 24 April 2023). 

42 Crime and Courts Act 2013. Available at: https://www.legislation.gov.uk/ukpga/2013/22/contents/enacted 
(Accessed 24 April 2023). 

43 See: https://pressrecognitionpanel.org.uk/the-royal-charter/ (Accessed 24 April 2023). 

44 DCMS (2020) National data strategy. Available at: https://www.gov.uk/government/publications/uk- 
national-data-strategy/national-data-strategy (Accessed 24 April 2023). 

45 DCMS (2019) The Cairncross Review: A sustainable future for journalism. Available at: 
https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/779882/0 
21919 DCMS Cairncross Review _.pdf (Accessed 24 April 2023). 
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acknowledged the economic pressures on journalism operating in a competitive 
and evolving digital environment. 


The code helps people to comply with data protection law, reflecting the 
introduction of the GDPR and the changing realities of the digital world, which 
the law is a response to. The code also reflects the special public interest in 
freedom of expression and information, whilst providing practical guidance that 
is mindful of the context in which journalists generally operate. The ICO will 
continue to engage with industry stakeholders about the practicalities of the 
code in this context. 


Industry codes on press standards 


Press standards more generally are dealt with by a number of industry codes of 
practice and guidelines, including: 


e Independent Press Standards Organisation (IPSO) Editors’ Code of 
Practice, *® 

e IMPRESS Standards Code, *” 

e BBC Editorial Guidelines,*® and 

e Ofcom Broadcasting Code.*? 


These should be distinguished from the ICO code, which does not concern 
general media standards. Rather it is limited to journalism in the context of data 
protection law, as explained above. 


The industry codes include considerations about data protection. For example, 
IPSO’s Editor’s code covers accuracy and the public interest generally. The ICO 
code complements industry codes, providing more detail about the specific 
application of data protection in these areas and others which are not covered by 
industry codes. 


Generally, we consider the industry codes and the ICO’s code to be well-aligned. 
Speaking to the organisations responsible for industry codes and involving them 
in the public consultation exercise has allowed us to enhance the code’s 
alignment further. 


Policy in development 


There are various bills at different stages of development which relate to the 
media and journalism. We have highlighted some of the main ones below, and 


46 IPSO (2021) Editors’ Code of Practice. Available at: https://www.ipso.co.uk/editors-code-of-practice/ 
(Accessed 24 April 2023). 

47 IMPRESS (n.d.) Know your code. Available at: https://www.impress.press/standards/impress-standards- 
code/our-standards-code (Accessed 24 April 2023). 

48 BBC (n.d.) Editorial Guidelines. Available at: https://www.bbc.co.uk/editorialquidelines/guidelines/ (Accessed 
24 April 2023). 

49 Ofcom (2020) The Ofcom Broadcasting Code. Available at: https://www.ofcom.org.uk/tv-radio-and-on- 
demand/broadcast-codes/broadcast-code (Accessed 24 April 2023). 
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have indicated briefly at a high-level how the code would be likely to align with 
current plans. 


The Data Protection and Digital Information (DPDI) bill 


The DPDI bill was re-introduced to Parliament earlier this year.°° The ICO 
supports the bill’s ambition to enable organisations to grow and innovate whilst 
maintaining high standards of data protection rights. Data protection law needs 
to give people confidence to share their information to use the products and 
services that power our economy and society. The code contributes to this, 
providing practical guidance reflecting the importance of the public interest in 
freedom of expression and information, and a free press. It also helps to build 
and sustain public trust in journalism. 


The ICO is continuing to work constructively with the government to monitor 
how these reforms are expressed in the Bill, as it continues its journey through 
Parliament. We will update the code accordingly to reflect changes to data 
protection law. 


Online Safety bill 


The Online Safety bill? aims to respond to the risks posed by harmful activity 
and content online, particularly the increased risks to children. The bill aims to 
increase the accountability of technology companies, in line with the significant 
role they play in people’s lives, by introducing a new duty of care. Managing 
online harms needs to be balanced against the contribution to economic growth 
made by digital technology and the importance of protecting freedom of 
expression. The bill therefore proposes protections for journalism. 


The ICO is actively engaging with DSIT and Ofcom to share knowledge and 
ensure consistency where appropriate. The ICO has also responded to the call 
for evidence. > 


Draft Media bill 


The government has published a draft Media bill? which it says will help public 
service broadcasters better compete with streaming giants. It is part of 
government plans to modernise broadcasting laws. The draft Media bill proposes 
to increase competition by ensuring that streaming giants meet the same high 


5° DSIT (2023) British businesses to save billions under new UK version of GDPR. Available at: 

https ://www.gov.uk/government/news/british-businesses-to-save-billions-under-new-uk-version-of-gdpr 
(Accessed 23 May 2023). 

51 DCMS and DSIT (2021) Draft Online Safety Bill. Available at: 

https ://www.gov.uk/government/publications/draft-online-safety-bill (Accessed 24 April 2023). 

52 ICO (2021) The Information Commissioner’s response to the Draft Online Safety Bill (Joint Committee) Call 
for Evidence. Available at: https://ico.org.uk/media/about-the-ico/consultation-responses/4018386/draft- 
online-safety-bill-ico-response-to-joint-committee-call-for-evidence.pdf (Accessed 24 April 2023). 

53 DCMS (2023) New laws to help bring more great shows to British screens and airwaves. Available at: 
https ://www.gov.uk/government/news/new-laws-to-help-bring-more-great-shows-to-british-screens-and- 
airwaves (Accessed 23 May 2023). 
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standards expected of public service broadcasters, bringing them under Ofcom’s 
remit. 


The bill includes provisions to repeal Section 40 of the Crime and Courts Act.>* 
Section 40 was written in response to the Levenson Inquiry, which 
recommended legal remedies should be more easily available to ordinary 
members of the public. Many organisations in the media industry oppose section 
40.°° More specifically, they oppose its condition to pass on the legal costs of 
claimants even in unsuccessful cases when publishers are not members of a 
regulator approved by the Press Recognition Panel created after the Levenson 
Inquiry. Currently, only one regulator has been approved via this route, 
IMPRESS. 


The code applies to anyone falling within the scope of the UK GDPR and 
processing personal data for journalism. Data protection law applies to 
organisations using personal data that operate within the UK, as well as 
organisations outside the UK offering goods or services to people in the UK. By 
helping people to understand data protection law and good practice, the code 
would generally complement the bill’s stated aims to increase standards. 


Digital Markets and Consumer bill 


The government has proposed to introduce a new digital regime which will 
protect consumers and boost competition in digital markets. As part of the bill, a 
Digital Markets Unit (DMU) within the Competition and Markets Authority (CMA) 
will be given new powers to tackle what the government says is the excessive 
dominance of a small number of tech companies, which is considered to stifle 
innovation and economic growth. °° 


A news media bargaining code is proposed to level the playing field between 
news publishers and platforms by ensuring that platforms are compelled to 
negotiate to use news publisher content fairly. A scheme with similar objectives 
operates in Australia. °” 


This would be relevant to the data protection and journalism code as the news 
media bargaining code would apply to in-scope online platforms who process 
personal data for journalism. 


54 Crime and Court Act 2013. Available at: https://www.legislation.gov.uk/ukpga/2013/22/contents (Accessed 
9 June 2023) 

55 News Media UK (2023) NMA Welcomes Repeal of Section 40 In Draft Media Bill. Available at: 

https ://newsmediauk.org/blog/2023/03/29/nma-welcomes-repeal-of-section-40-in-draft-media-bill/ (Accessed 
26 May 2023). 

56 House of Commons (2023) Digital Markets, Competition and Consumer Bill. Available at: 
https://bills.parliament.uk/bills/3453 (Accessed 30 May 2023). 

57 ACCC (n.d.) Digital platforms and services. Available at: https://www.accc.gov.au/by-industry/digital- 
platforms-and-services (Accessed 30 May 2023). 
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Strategic litigation against public participation (SLAPP) 


Following a public consultation, government committed in 2022 to introducing a 
law aimed at curbing the use of strategic litigation against public participation, 
known as SLAPPs.°® This term is generally used to describe situations when it is 
considered that a person, particularly a wealthy person, is seeking to abuse the 
legal system in a way that is regarded as undermining legitimate scrutiny and 
posing a threat to press freedom. There is currently no timeline set for 
legislation relating to SLAPPs. 


The code aligns with the general spirit of these proposals in explaining how to 
apply the journalism exemption. It explains that there is a way to refuse 
requests to exercise data protection rights if they are manifestly unfounded or 
excessive. The code’s supporting reference notes also highlight more detailed 
ICO guidance explaining how to apply these parts of data protection law. 


58 MoJ (2022) Consultation outcome: Strategic Lawsuits Against Public Participation. Available at: 
https ://www.gov.uk/government/consultations/strategic-lawsuits-against-public-participation-slapps (Accessed 
9 June 2023) 
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4. Detail of proposed intervention 


This section provides an overview of the proposed intervention, the code, 
including its associated activities and outputs. It outlines the objectives of the 
code, how it was developed, and the groups we expect to be affected by it 
(affected groups). 


4.1. The code 


The data protection and journalism code is a statutory code of practice prepared 
under section 124 of the DPA 2018. The Information Commissioner was required 
to prepare a code providing: 


e practical guidance about processing personal data for the purposes of 
journalism in accordance with the requirements of the data protection 
legislation, and 

e other guidance to promote good practice in processing personal data for 
the purposes of journalism, where appropriate. 


The code does not impose any legal requirements beyond those already in the 
legislation. It will help controllers to understand their legal obligations under the 
UK GDPR and the DPA 2018, and to comply effectively. 


High level objectives of the code 


Bearing in mind the requirements set out above, the key objectives of the code 
are to: 


e Provide practical guidance to help controllers comply with data protection 
legislative requirements and good practice when processing personal data 
for the purposes of journalism. 

e Build on and update the guidance for the media we published in 2014°° to 
reflect changes to legislation, case law and other developments. 

e Make sure the code reflects the importance of the right to freedom of 
expression and information, and the media freedom which is vital to this. 
The code must also protect personal data and the right to privacy, when 
applying data protection law. In particular, the code has to help people to 
understand how the journalism exemption applies. 

e Promote accountability in line with the key data protection principle which 
requires accountability under the UK GDPR, particularly concerning 
justifying publication in the public interest and accuracy. 

e Help build and sustain public trust in processing personal data for the 
purposes of journalism. Ultimately, this supports the crucial public interest 


5 ICO (2014) Data protection and journalism: a guide for the media. Available at: 
https://ico.org.uk/media/for-organisations/documents/1552/data-protection-and-journalism-media- 
guidance.pdf (Accessed 26 May 2023). 
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role journalism plays in contributing to the free flow of communication and 
acting as the ‘public’s watch dog’. 


4.2. Development of the code 


The primary activity delivered by the ICO was the development of the code. This 
will be supported by awareness and engagement activities. The ICO will also 
need to provide advice, promote good practice, and assess compliance with the 
code. In line with the theory of change for the code (see Figure 1), this is 
expected to deliver outputs including organisations, journalists and wider society 
engaging with the code that then lead to impacts. 


Figure 4: Code development timeline 


Call for views 


meat Second public 
Dratticode consultation 
First public 
consultation 


Workshops with 
industry and 
media experts 


COVID-19 period 


2019 2020 2021 2022 2023 


Source: ICO Economic Analysis. 


Figure 4 shows some of the key milestones in the development of the code, 
which include: 


e initial call for views: the ICO ran the call (ending in May 2019) to gather 
views from stakeholders and inform the initial stages of the code’s 
development, ©° 

e COVID-19 period: the COVID-19 pandemic meant the ICO had to focus 
more of its resources on responding to the pandemic, 

e initial draft code: the initial draft of the code was published in October 
2021 alongside a summary of the responses to the initial call for views, 

e first public consultation: the ICO ran a public consultation over a 12 week 
period (ending January 2022) on a revised draft of the code,°! 

e second public consultation: key representative groups (including the 
Media Lawyers Association) requested reconsideration of the draft code 


6° ICO (2019) Responses to the call for views on a data protection and journalism code of practice. Available 
at: https://ico.org.uk/about-the-ico/ico-and-stakeholder-consultations/responses-to-the-call-for-views-on-a- 
data-protection-and-journalism-code-of-practice/ (Accessed 23 May 2023). 

61 ICO (2022) First consultation: draft Data protection and journalism code of practice. Available at: 
https://ico.org.uk/media/about-the-ico/consultation-responses/journalism-code/4021594/ico-first- 
consultation-draft-journalism-code-responses-summary.pdf (Accessed 23 May 2023). 
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and a second consultation was ran over an eight week period ending in 
November 2022,° 

e workshops with industry and media experts: there were three workshops 
tailored to different stakeholder groups - November 2022, 

e the code: the code was updated in response to feedback from the 
consultation and workshops and published in summer 2023. 


A draft impact assessment was provided to support the first and second public 
consultations. Only a small number of responses referred to the impact 
assessment. These focused on requesting clarity on the assumptions used rather 
than highlighting significant gaps in the analysis. Where clarity was sought, we 
have addressed this within the assessment. For example, we have included 
sensitivity analysis in Annex A to evidence the sensitivity of impact estimates to 
changes in assumptions. 


4.3. Scope of the code 


The code contains guidance for those processing personal data for journalism 
who must comply with the UK GDPR and DPA 2018. Data protection law applies 
to organisations processing personal data that operate within the UK. It also 
applies to organisations outside the UK that offer goods or services to people in 
the UK. 


Data protection law does not define journalism, so the code takes an 
appropriately broad and flexible approach in accordance with its everyday 
meaning and purpose and key case law set out in the code’s supporting 
reference notes. 


The code also acknowledges that personal data can be used for journalism as 
well as other purposes. For example, a campaign group can use data for 
journalism and to campaign for a particular cause. 


62 ICO (2022) ICO launches second consultation on the draft Data protection and journalism code. Available at: 
https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2022/09/ico-launches-second-consultation-on- 
the-draft-data-protection-and-journalism-code (Accessed 23 May 2023). 
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4.4. Affected groups 


Groups affected by the code are wide and varied, reflecting the broad definition 
of journalism outlined above. 


The code is mainly for media organisations and journalists employed by them 
who use personal data for journalism. For example, those producing newspapers 
and magazines, in print or online, and broadcasting on television or radio. 


However, the code acknowledges that journalism is not limited to professional 
and media organisations. It also covers others who may sometimes use personal 
data for journalism. For example, members of the public may carry out 
journalism, typically online, which is sometimes referred to as ‘citizen 
journalism’. 


The code affects people whose personal data is processed for journalism, the 
ICO as the regulator of the data protection legislation, and courts and tribunals, 
that are required to take account of the code, where relevant. 


The code may also impact people and organisations indirectly. This includes the 
impact of society-wide harms and benefits, as well as impacts on organisations 
that supply or interact with journalists. 


Figure 5: Affected groups 


Professional journalists { The Information 
and media organisations Commissioner's Office 
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Source: ICO Economic Analysis. 


Professional journalists and media organisations 


It is estimated that there are 107,000 professional journalists and editors in the 
UK, equivalent to 0.3% of all people employed nationally.°? Employment in 
journalism related industries is not evenly distributed across UK regions. Around 


63 ONS (2023) Annual Population Survey - regional - employment by occupation (SOC2020). Available at: 
https ://www.nomisweb.co.uk/datasets/aps218 (Accessed 30 May 2023). 
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half (48%) of these jobs are based in London, with another 19% in the East and 
South East. 


As already highlighted in section 3.2.2, it is not possible to estimate the total 
number of media organisations in the UK, as their structures and activities are 
often complex. 


e The ICO data protection register has 3,082 people or organisations 
registered under ‘Journalist’ as well as 4,609 under ‘TV and radio 
station’. 64 

e Business count data from the ONS,® gives an estimate of around 5,300 
enterprises operating across the sector. 


This affected group has been under significant economic pressure®® and the 
assessment recognises that the sector is particularly sensitive to additional costs 
or burdens. 


Other organisations or people involved in processing personal data for 
the purposes of journalism 


It is not possible to quantify the size of this group given how wide and varied 
these people and organisations are, and that journalism is not necessarily their 
only or main purpose. This group includes some online services and citizen 
journalists, for example. 


People whose data is processed for the purposes of journalism 


As with the group above, it is not possible to quantify the size of this group of 
people given the very broad scope of journalism. We have no way of estimating 
how many people’s data has been processed for the purposes of journalism or 
will be processed in the future. 


The Information Commissioner’s Office 


The ICO will be affected, as the regulator of data protection legislation. In 
accordance with section 127(4) of the DPA 2018, the Commissioner must take 
the provisions of this code into account in determining a question arising in legal 
proceedings where relevant. 


The ICO will also need to provide advice, promote good practice, and assess 
compliance with the code. There are some limited enforcement provisions for 
journalism under the DPA 2018. However, in recognition of the special public 


64 ICO, Analysis of the Data protection register for the financial year 2023/24. 

65 ONS (2022) UK business; activity, size and location. Available at: 
https://www.ons.gov.uk/businessindustryandtrade/business/activitysizeandlocation/bulletins/ukbusinessactivit 
ysizeandlocation/2022 (Accessed 02 June 2023). 

66 The Cairncross Review (2019) A sustainable future for journalism. Available at: 
https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/779882/0 
21919 DCMS Cairncross Review _.pdf (Accessed 24 April 2023). 


24 


Data protection and journalism code impact assessment Who? 


interest in freedom of expression, the ICO’s powers are significantly restricted in 
this respect. 


The DPA 2018 includes a statutory requirement for a review of processing of 
personal data for the purposes of journalism under section 178. The code sets 
out the standards against which we will review processing for journalism in 
practice, once it comes into force. The ICO must report to the Secretary of State 
about this. 


Justice system 


The justice system will be affected because, in accordance with section 127(3) of 
the DPA 2018, a court or tribunal must take the provisions of the code into 
account in legal proceedings, where relevant. 


Wider society 


There could be wider impacts on people whose personal data is not processed 
for the purposes of journalism. These may arise either as a result of the impact 
on people who consume journalism or because of broader societal impacts, such 
as trust in journalism or prejudice to the course of justice. 


There could also be impacts on organisations and businesses that are not 
journalists but whose activities are connected to them, for example, businesses 
that supply journalism organisations. This could include law firms, website 
hosting providers or freelancers, such as photographers, who serve 
organisations involved in processing personal data for the purposes of 
journalism. 
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5. Costs and benefits of the code 


In this section of the report, we consider the code’s potential costs and benefits. 
Our aim is to understand whether there are likely to be significant impacts on 
affected groups (both positive and negative) and to judge the code’s overall 
impact on society. 


We draw on a mixture of quantitative and qualitative evidence but, as noted 
above, our analysis is limited by the evidence available. 


The analysis of impacts is split into three parts: 


e familiarisation costs, 
e reduction in data protection harms, and 
e impact of greater organisational confidence in processing personal data. 


In identifying the potential impacts of the code, it is important to distinguish 
between: 


e Additional impacts that can be attributed to the code: these impacts are 
affected by how the ICO chooses to develop the code; and 

e Additional impacts that are not attributed to the code: these impacts are 
not affected by how the ICO chooses to develop the code. They simply 
arise from the legislative requirements. This includes the requirements 
under section 124 of the DPA 2018, including to create the code, and the 
general requirements of the UK GDPR and the DPA 2018. Controllers are 
already expected to comply with these requirements. 


Our analysis considers the impacts of the code that are additional to those of the 
legislation. The analysis excludes impacts that cannot be attributed to the code 
and instead result from existing legislation, as these would exist regardless of 
the code. 


Impacts may be direct or indirect: 


e Direct impacts: these are ‘first round’ impacts that are generally 
immediate and unavoidable, with relatively few steps in the chain of logic 
between the introduction of the measure and the impact taking place. 

e Indirect impacts: these are ‘second round’ impacts that are often the 
result of changes in behaviour or reallocations of resources following the 
immediate impact of the introduction of the measure. 


The impacts are assessed under the following headings, which then feed into our 
conclusion on the code’s overall impact on society: 


6&7 Regulatory Policy Committee (2019) RPC case histories - direct and indirect impacts. Available at: 
https ://www.gov.uk/government/publications/rpc-case-histories-direct-and-indirect-impacts-march-2019 
(Accessed 30 May 2023). 
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e Cost: a discussion of the related costs that could bring about significant 
impacts to affected groups. 

e Benefits: as with costs. 

e Categorisation of impact: where possible, additional impacts are 
categorised as negative (a net cost), positive (a net benefit), or neutral 
and either attributable or not attributable to the code. 


Figure 6: Intended impacts 
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Source: ICO Economic Analysis. 


5.1. Cost benefit analysis 


The analysis and assessment of impacts is covered in the sections below. 


5.1.1. Costs 


Potential costs of the code are set out below. 


Familiarisation costs 


Controllers will incur a direct cost as a result of the code because of the time 
taken to read and become familiar with it. These are referred to as 
familiarisation costs.68 The code contains guidance for all controllers processing 
personal data for the purposes of journalism. However, it may not be necessary 


68 BEIS (2017) Business impact target: appraisal of guidance assessments for regulator-issued guidance. 
Available at: https://www.bl.uk/collection-items/beisc-business-impact-target-appraisal-of-quidance- 
assessments-for-regulator-issued-guidance-2017 (Accessed 24 April 2023). 
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for all controllers to familiarise themselves with the whole code. For example, 
this may be the case for smaller organisations that undertake lower risk 
processing. It should also be acknowledged that there is already existing data 
protection guidance for media organisations, produced in 2014.°? However, this 
does not hold the status of a code of practice under the DPA 2018 and is 
therefore not directly comparable to the code. For this reason, we have not 
considered it further as part of the assessment or the counterfactual. 


The indicative familiarisation costs are estimated to be between £220,000 to 
£410,000, with an individual cost of about £50 per organisation or person. 
However, this is only to indicate the scale of this impact in aggregate. The costs 
are estimated using the best available information on the number of 
organisations in the media industry and the likely time taken to read it. These 
estimates can change significantly depending on the estimated number of 
organisations in scope. See Annex A for more detail on the implications of our 
estimates. 


We recognise that the level of engagement with the code will vary significantly 
across different media organisations. For example, large organisations may 
engage multiple professionals and organise staff training to become familiar with 
the code; other smaller organisations may devote significantly less time. 


It is not possible to accurately estimate the number of organisations or people 
that will need to familiarise themselves with the code, and as such the figures 
provided are an indicative estimate only. 


There are further details of the method used to estimate familiarisation costs in 
Annex A. 


Categorisation of impact 


The impact on controllers of needing to become familiar with the code is a 
natural consequence of the requirement to produce a statutory code of practice 
under section 124 of the DPA 2018. 


Section 124 is not explicit about the precise content and length of the code and 
enables some judgement on what the Commissioner considers appropriate. 
However, this discretion does not necessarily imply that there is an additional 
impact. A similar assessment was also made for the impacts of familiarisation of 
the data sharing code”? and age-appropriate design code.”! 


Our assessment acknowledges that the issue of attribution here is complex. 
However, we have assumed that even if elements of the code could be perceived 


© ICO (2014) Data protection and journalism: a guide for the media. Available at: 
https://ico.org.uk/media/for-organisations/documents/1552/data-protection-and-journalism-media- 
guidance.pdf (Accessed 26 May 2023). 

70 ICO (2021) Data sharing: a code of practice. Available at: https://ico.org.uk/for-organisations/uk-gdpr- 
guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/ (Accessed 30 May 2023). 

71 ICO (2020) Age appropriate design: a code of practice for online services - Impact assessment. Available at: 
https://ico.org.uk/media/2617988/aadc-impact-assessment-vi_ 3.pdf (Accessed 19 April 2023). 
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to be additional, these are not attributable to the code itself. In the absence of 
further evidence, the impacts are assessed as negative but not attributable 
to the code. 


5.1.2. Benefits 


The potential benefits are set out below. 


Reduction of data protection harms related to the processing of personal 
data for journalism 


As illustrated in section 3.2.3, data protection harms may occur when personal 
data is processed for the purposes of journalism. Although the harms presented 
do not necessarily point to specific areas of non-compliance, the examples 
provided do correlate to key principles of data protection law. The code also 
includes guidance on key areas that are relevant to journalism, such as 
considering the public interest and making sure that personal data is accurate. 


The guidance is likely to contribute to reducing the risk and severity of the types 
of harms we have identified in this assessment. Even a small contribution to 
minimising harms would be helpful in view of the potentially very damaging 
consequences for people. 


The code encourages controllers to demonstrate accountability throughout, 
which is a key data protection principle introduced by the UK GDPR. There are 
benefits to putting in place appropriate, risk-based data protection measures and 
being able to demonstrate this. These are that controllers manage risks and 
harms associated with the processing of personal data. In turn, this increases 
confidence, both within and outside the industry. 


Increased confidence for those processing personal data for the 
purposes of journalism 


There is a high degree of uncertainty around impacts related to increased 
confidence. It is not possible to make a robust estimate of how additional these 
impacts are. 


The code will provide greater regulatory certainty and clarity because it is 
tailored specifically to the context of journalism. It is therefore likely to increase 
confidence within the industry generally. This will support the freedom of the 
press, particularly in circumstances where there may be more uncertainty about 
how to balance freedom of expression and privacy rights. This may increase 
efficiency, which is particularly important in the context of journalism given its 
competitive nature and the increased challenges of digital publication. 


Increased accountability may result in higher public trust levels, which are 
reported to be comparatively low.’* This may increase public engagement with 


72 Reuters Institute for the Study of Journalism (2022) 2022 Digital News Report. Available at: 
https://reutersinstitute.politics.ox.ac.uk/digital-news-report/2022/united-kingdom (Accessed 20 April 2023). 
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journalism. This indirectly improves the public interest benefits that journalism 
aims to serve that are fundamental to our democracy. For example, the free flow 
of communications and public accountability of people in powerful positions. 


Increased regulatory certainty and confidence may result in more consistent 
understanding and application of the law across organisations. The code is a 
free-to-use resource by the data protection regulator that is tailored specifically 
to the needs of this sector. It may increase competition and may also support 
smaller organisations with more limited access to other resources, such as legal 
advice, to participate more fully. Additional confidence may also enable 
innovation and economic growth. 


Where organisations are not aware that they are processing personal data for 
the purposes of journalism, they may benefit from the code’s guidance and 
knowledge of data protection provisions which protect freedom of expression. 


Categorisation of impact 


The code is likely to offer significant benefits to society. This is because it is 
likely to provide greater regulatory certainty, increase confidence, and reduce 
harms. The discretion given to the Commissioner under Section 124 means that 
some of these impacts can be attributed to the code itself rather than the 
statutory duty. The impacts in these areas are assessed as positive and 
attributable to the code. 


It is difficult to draw firm conclusions about the likelihood and scale of the code’s 
benefits. This is because these benefits are often intangible, vary according to 
the circumstances, and depend on behaviour change. 


5.2. Overall assessment of impacts 
We summarise our assessment of impacts in the table below: 


Table 2: Costs and benefits 


Pra l - 
or negative 


Familiarisation costs Negative Not attributable to the code 
PEURA data Protection Positive Attributable 

harms 

ieee pees ane Positive Attributable 

organisational confidence 

Overall assessment Positive Attributable 


Source: ICO Economic Analysis. 


The extent to which impacts are attributable to the code varies across the types 
of impact. This is primarily because of the terms of the existing statutory 
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requirement to produce the code and the need for controllers to comply with the 
legislation. 


Where there may be some discretion, we have considered: 


e responses to the call for views and public consultation, 
e the special public interest in freedom of expression and information, and 
e the circumstances in which journalists often operate. 


There is limited potential for additional costs that would be attributable to the 
code. This is in view of the legislative background to the code and the steps 
taken by the ICO to produce it. 


We consider that the code is likely to have some significant additional beneficial 
impacts. This is due to increased regulatory certainty, confidence, and reducing 
the risk and severity of harms in the context of data protection and journalism. 
However, it is difficult to draw firm conclusions about the likelihood and scale of 
these benefits, which largely depend on behaviour change. 


There was not enough evidence to assess how impacts would be distributed 
amongst different groups and as such we were not able to specifically identify 
any distributional impacts. 


Overall, any costs associated with the code are considered to be significantly 
outweighed by the additional societal benefits that the code may produce. These 
benefits align strongly with specific policies and complement existing industry 
codes. 


31 


Data protection and journalism code impact assessment 


6. Monitoring and review 


The code will be kept under review in line with good regulatory practice, with 
s124 (2) DPA 2018 allowing the Commissioner to make amendments or lay a 
replacement code. 


There is also an ongoing statutory review of journalism as per s177 of DPA2018. 
Although this does not constitute a review of the code itself, it will be helpful in 
informing ongoing compliance and conformance monitoring and the effectiveness 
of the code. 
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Annex A: Estimating familiarisation costs 


This annex sets out the approach taken to estimate familiarisation costs for the 
code, which follows a standard approach used to appraise regulator-issued 
guidance or provisions. 7? 


Organisations or people in scope 


As with identifying affected groups in section 4.41.1, it is not possible to produce 
a robust estimate of the organisations that would be expected to familiarise 
themselves with the code. However, we can provide an indicative range to 
demonstrate the type of costs related to familiarisation. 


In the absence of more robust data on those in scope of the code, we have used 
the total number of organisations or people on the data protection register 
related to journalism, and television and radio broadcasting. As of April 2023, 
this was approximately 7,690. We use this as our high-end estimate, as this is a 
scenario where all of these organisations or people read the code. 


Government guidance on appraisal of regulator-issued guidance”* states that not 
all organisations engage with and use guidance, as a source of information on 
how to comply with regulation. Across sectors, the share of businesses that use 
guidance is estimated at 54%.”° In the absence of specific evidence, we use this 
to calculate our low-end estimate, reflecting a scenario where only 54% of the 
relevant organisations on the ICO’s data protection register use the code. 


This results in a range of 4,153 to 7,691 organisations or people being affected 
by the code. 


Familiarisation costs 


Drawing on impact assessment guidance,” we have estimated the total time for 
reading the code at one hour and 52 minutes. This is based on a word count of 
around 8,400 words and a Fleisch reading ease score of 37. 


73 BEIS (2017) Business impact target - appraisal of guidance: assessments for regulator-issued guidance. 
Available at: 

https://assets. publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/609201/b 
usiness-impact-target-quidance-appraisal.pdf (Accessed 24 April 2023). 

74 BEIS (2017) Business impact target - appraisal of guidance: assessments for regulator-issued guidance - 
sections 2.3 and 2.4. Available at: 

https://assets. publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/609201/b 
usiness-impact-target-quidance-appraisal.pdf (Accessed 24 April 2023). 

75 Department for Business Innovation & Skills (2014) Business Perceptions Survey 2014. Available at: 
https://assets. publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/314378/1 
4-p145-business-survey-2014.pdf (Accessed 02 June 2023). 

76 BEIS (2017) Business impact target: appraisal of guidance assessments for regulator-issued guidance. 
Available at: 
https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/609201/b 
usiness-impact-target-quidance-appraisal.pdf (Accessed 24 April 2023). 
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For the purposes of this assessment, we have made the simplifying and 
conservative assumption that each organisation or person will read the code 
once in its entirety. However, this is only intended to provide an indicative 
average for the assessment of familiarisation costs. It is not a recommendation 
on how organisations or people should familiarise themselves with the code, as 
this will differ on a case-by-case basis. Some will need to read significantly less, 
and a small subset may need multiple people to read it. This assumption is 
tested under sensitivity analysis below. 


The impact of familiarisation can be monetised using data on wages from the 
ONS Annual Survey of Hours and Earnings (ASHE).’” Assuming that the relevant 
occupational group is ‘Managers, Directors and Senior Officials’, the 2022 
median hourly earnings (excluding overtime) for this group is £23.25. 


This hourly cost is up-rated for non-wage costs using the latest figures from 
Eurostat”? and in line with Regulatory Policy Committee guidance,’ resulting in 
an uplift of 22% and an hourly cost of £28.35. 


Using this hourly cost, and making the simplifying assumption of one person 
being responsible for familiarisation for each of the relevant organisations or 
people, ®° we estimate the cost of familiarisation per organisation or person to be 
around £50. The total estimated familiarisation costs for the code ranges from 
£220,000 to £410,000. 


Sensitivity analysis 
There are two variables in our model that are subject to sensitivity analysis: 


1) The number of times that an organisation or person reads the code 


Table 3: Sensitivity test - number of reads 


No. of Number of reads 

companies 

affected 1 2 

Low estimate £110,000 £220,000 £440,000 £1,100,000 
High estimate £205,000 £410,000 £820,000 £2,050,000 


77 ONS (2022) Employee earnings in the UK. Available at: 

https ://www.ons.gov.uk/employmentandlabourmarket/peopleinwork/earningsandworkinghours/bulletins/annua 
Isurveyofhoursandearnings/latest (Accessed 24 April 2023). 

78 Eurostat (2023) Labour cost levels by NACE Rev. 2 activity. Available at: 
https://ec.europa.eu/eurostat/databrowser/view/Ic_ Ici_lev/default/table?lang=en (Accessed 30 May 2023). 

7? RPC (2019) RPC guidance note on ‘implementation costs’. Available at: 
https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/827926/R 
PC_short_guidance_note - Implementation costs August _2019.pdf (Accessed 24 April 2023). 

80 In reality there may be one person responsible for understanding the code for multiple organisations or 
multiple people in one organisation, but in the absence of data to make a precise estimate, the simplifying 
assumption is deemed appropriate. This is tested below under Sensitivity Analysis. 
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Source: ICO Economic Analysis. 
2) The time taken for one person to read the code 


Table 4: Sensitivity test - reading time 


No. of companies Time 

affected -10% 1h 52m | +10% 

Low estimate £198,000 £220,000 £242,000 
High estimate £369,000 £410,000 £451,000 


Source: ICO Economic Analysis. 


The impact estimates are linearly related to the two assumptions tested above. 
This means an increase or decrease in one of the assumptions leads to a 
proportionate increase or decrease in the impact estimate. Using the indicative 
increases or decreases shown above to produce sensible upper and lower 
bounds, familiarisation costs could be as low as £110k or as high as £2.05m. 
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